add release artifacts: license, CI, tests, and policy docs

- MIT LICENSE
- CHANGELOG.md (CalVer, first entry 2026.04.15)
- CODE_OF_CONDUCT, CONTRIBUTING, SECURITY, SUPPORT policies
- docs/release.md covering preflight, tagging, rollback
- GitHub Actions CI running shell syntax, shellcheck,
  desktop-file-validate, script tests, and nix flake check
- tests/ harness with activate-path and preflight checks;
  preflight test stubs `id` via PATH so it cannot launch real
  Steam on a developer machine where /opt/steam already exists

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  shell-and-release-guards:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install shell tooling
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck desktop-file-utils
+
+      - name: Bash syntax check
+        run: bash -n scripts/*.sh tests/*.sh
+
+      - name: ShellCheck
+        run: shellcheck scripts/*.sh tests/*.sh
+
+      - name: Desktop entry validation
+        run: desktop-file-validate desktop/steam.desktop
+
+      - name: Script tests
+        run: tests/run.sh
+
+  nix-flake-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+
+      - name: Flake check
+        run: nix flake check --no-build --no-write-lock-file